PT-2019-4786 · Apache+5 · Mod Auth Openidc+6

Oss-Aimoto · Publicado 2019-11-08 · Atualizado 2025-12-29 · CVE-2019-14857

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.0.1 Apache HTTP Server (affected versions not specified)

Description A flaw exists related to open redirect issues in URLs with trailing slashes. There is also an issue with insufficient protection of web pages in the mod auth digest component of the Apache HTTP Server, which could allow a remote attacker to gain unauthorized access to confidential information or execute arbitrary code.

Recommendations For mod auth openidc versions prior to 2.4.0.1, update to version 2.4.0.1 or later. For Apache HTTP Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

ALSA-2020:3032

BDU:2020-01364

CESA-2020_3032

CESA-2020_3970

CVE-2019-14857

DLA-1996-1

DLA-2298-1

MGASA-2019-0410

OPENSUSE-SU-2019:2499-1

OPENSUSE-SU-2019_2499-1

OPENSUSE-SU-2024:10624-1

RHSA-2020:3032

RHSA-2020:3970

RHSA-2020_3032

RHSA-2020_3970

RLSA-2020:3032

SUSE-SU-2019:2934-1

SUSE-SU-2019:2935-1

SUSE-SU-2019_2934-1

SUSE-SU-2019_2935-1

SUSE-SU-2025:4532-1

Produtos afetados

Almalinux

Apache Http Server

Centos

Red Hat

Rocky Linux

Suse

Mod Auth Openidc

Referências · 57

• https://github.com/zmartzone/mod_auth_openidc/commit/5c15dfb08106c2451c2c44ce7ace6813c216ba75 · Correção
• https://github.com/zmartzone/mod_auth_openidc/commit/ce37080c6aea30aabae8b4a9b4eea7808445cc8e · Correção
• https://github.com/zmartzone/mod_auth_openidc/pull/451 · Correção
• https://osv.dev/vulnerability/RLSA-2020:3032 · Aviso do Fabricante
• https://vulners.com/cve/CVE-2019-20479 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2019:2935-1 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2020-3970.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14857 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14857 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-01364 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2025:4532-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-14857 · Nota
• https://t.me/cvenotify/51162 · Publicação no Telegram
• https://osv.dev/vulnerability/openSUSE-SU-2024:10624-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/ALSA-2020:3032 · Aviso do Fabricante